lucianoandClaude Opus 4.7
bb48357179
ADR 0003: VAPID self-hosted today, DeviceToken model agnostic to
platform so iOS/Android (Expo/APNs/FCM) plug in as new senders later.
Backend (apps/api/src/modules/notifications)
- sender.ts: NotificationSender interface, WebPushSender via VAPID
- notifications.routes.ts: GET /me/notifications/config, POST/DELETE
/me/device-tokens, PATCH /me/notifications/settings, POST /me/notifications/test
- scheduler.ts: node-cron Mon 09:00 Europe/Rome for weekly weigh-in
reminder; auto-cleanup of expired tokens on 404/410
- env: VAPID_PUBLIC_KEY/PRIVATE_KEY/SUBJECT (all optional → push gracefully off)
Frontend
- public/sw.js minimal (push + notificationclick)
- lib/notifications/push-client.ts: subscribe / unsubscribe / getCurrentSubscription
- profile/notifications-{actions,panel}.tsx: editorial panel with toggles,
device list, "send test", per-device removal
- pushReady requires both permission AND active subscription (covers the
case where the user revoked the SW but kept the browser permission)
Schema
- DeviceToken { userId, platform, endpoint, p256dh, auth, token, userAgent,
createdAt, lastSeenAt } with unique(userId, endpoint)
- ExtendedPrismaClient type exported from @ketopath/db
- NotificationSettings zod schema in @ketopath/shared
Tooling
- lint-staged: split .js out of eslint glob so service worker is only
formatted (it lives outside the TS project)
i18n
- Notifications namespace (it) with typed error keys
Smoke tested: POST /me/device-tokens 201, POST /me/notifications/test 200,
real push delivered to a macOS Chrome device.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
34 lines
1.2 KiB
Bash
34 lines
1.2 KiB
Bash
NODE_ENV=development
|
|
PORT=4000
|
|
HOST=127.0.0.1
|
|
LOG_LEVEL=info
|
|
|
|
# CORS — origini consentite (separate da virgola)
|
|
CORS_ORIGINS=http://localhost:3000
|
|
|
|
DATABASE_URL=postgresql://luciano:luciano%40@localhost:5432/ketopath?schema=public
|
|
|
|
# Cifratura at-rest dei campi sanitari (vedi ADR 0002).
|
|
# Genera con: node -e "console.log('k1.aesgcm256.'+require('crypto').generateKeySync('aes',{length:256}).export().toString('base64url'))"
|
|
# DEVE coincidere con apps/web/.env e con tutti i deploy che leggono il DB.
|
|
PRISMA_FIELD_ENCRYPTION_KEY=
|
|
|
|
# Better Auth — DEVE coincidere con apps/web/.env (sessione condivisa)
|
|
BETTER_AUTH_SECRET=
|
|
BETTER_AUTH_URL=http://localhost:3000
|
|
|
|
# Google OAuth (configurato a fine progetto)
|
|
# GOOGLE_CLIENT_ID=
|
|
# GOOGLE_CLIENT_SECRET=
|
|
|
|
# Sentry — error tracking (lascia vuoto per disabilitare)
|
|
# SENTRY_DSN=
|
|
|
|
# Web Push — VAPID (vedi ADR 0003).
|
|
# Genera con: cd apps/api && node -e "console.log(require('web-push').generateVAPIDKeys())"
|
|
# La PUBLIC_KEY va anche in apps/web/.env come NEXT_PUBLIC_VAPID_PUBLIC_KEY.
|
|
# Lascia vuoto per disabilitare le push (il cron e gli endpoint rispondono 503).
|
|
VAPID_PUBLIC_KEY=
|
|
VAPID_PRIVATE_KEY=
|
|
VAPID_SUBJECT=mailto:hello@ketopath.app
|